From a30f0b2851a08fdeafb014fd515a8036fa37197b Mon Sep 17 00:00:00 2001
From: Kevin Ansfield <kevin@ghost.org>
Date: Fri, 8 May 2020 11:54:18 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=92=84=20Adjusted=20email=20previews=20to?=
 =?UTF-8?q?=20better=20represent=20email=20behaviour=20of=20embed=20cards?=
 =?UTF-8?q?=20(#1554)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

no issue

- added `sandbox` attribute which blocks scripts from running inside the iframe
- results in better representation of how embeds will render in emails where scripts are not allowed
---
 .../app/templates/components/modal-post-email-preview.hbs     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ghost/admin/app/templates/components/modal-post-email-preview.hbs b/ghost/admin/app/templates/components/modal-post-email-preview.hbs
index 57acc58185..edf2aa8a72 100644
--- a/ghost/admin/app/templates/components/modal-post-email-preview.hbs
+++ b/ghost/admin/app/templates/components/modal-post-email-preview.hbs
@@ -15,7 +15,7 @@
     <div class="modal-body modal-preview-email-content gh-pe-mobile-container" style="display: flex;justify-content: center;">
         <div class="gh-pe-mobile-bezel">
             <div class="gh-pe-mobile-screen">
-                <iframe class="bn gh-pe-iframe" {{did-insert this.renderEmailPreview}}></iframe>
+                <iframe class="bn gh-pe-iframe" {{did-insert this.renderEmailPreview}} sandbox="allow-same-origin"></iframe>
             </div>
         </div>
     </div>
@@ -23,6 +23,6 @@
 
 {{#if (eq this.type "desktop")}}
     <div class="modal-body modal-preview-email-content gh-pe-desktop-container">
-        <iframe class="bn miw-100 gh-pe-iframe" style="height:100%;" {{did-insert this.renderEmailPreview}}></iframe>
+        <iframe class="bn miw-100 gh-pe-iframe" style="height:100%;" {{did-insert this.renderEmailPreview}} sandbox="allow-same-origin"></iframe>
     </div>
 {{/if}}
\ No newline at end of file